Findings Lifecycle

Findings lifecycle

Confidence

Confidence	Meaning
CONFIRMED	A deterministic check observed the condition and recorded evidence. Exploitability is not implied.
STRONGLY_SUPPORTED	A specific signal with a low false-positive rate, or a hypothesis confirmed by a human.
HYPOTHESIS	Heuristic or model-proposed. Never listed as confirmed.

Status

stateDiagram-v2
    [*] --> OPEN: first observed
    OPEN --> REMEDIATED: collector ran OK and no longer observes it
    REMEDIATED --> REOPENED: observed again
    REOPENED --> REMEDIATED
    OPEN --> FALSE_POSITIVE: human, with note
    OPEN --> RISK_ACCEPTED: human, with note and expiry
    RISK_ACCEPTED --> REOPENED: expiry passed and still observed
    FALSE_POSITIVE --> REOPENED: human reopen

Loading

• If the collector that found an issue did not run or failed, the finding stays open and is marked STALE instead of being closed.
• Editing a file marks its findings STALE until the next scan.
• Fingerprints use the rule, the file, a stable key and the normalized redacted line, not line numbers, so moving code does not create duplicates.

Triage

pandaward findings show PW-0007
pandaward findings false-positive PW-0007 --by "Jane" --note "value is a compile-time constant"
pandaward findings accept-risk PW-0003 --by "Jane" --note "internal admin tool" --expires 2027-03-01
pandaward findings confirm PW-0012 --by "Jane" --note "reproduced with two test tenants"

Every change records the reviewer and note and appends an audit event (pandaward events).